Code security, in resalable rules.
A feed of SAST (static code analysis, Semgrep syntax) rules aggregated from permissive open-source sources, every rule validated on the real Opengrep engine, licenses vetted at the file level, mapped to CWE + OWASP-2021. Plus 1,371 secret-detection patterns and in-house forged taint-mode rules. Load them into your CI/CD, your code review, your DevSecOps pipeline. Ed25519-signed.
What we added recently
A living feed: here is the coverage added to it, dated.
- +95 règles
Broad coverage, mapped and CI-ready.
SQL injection (CWE-89), command injection (CWE-78), path traversal (CWE-22), LDAP/XPath injection, XXE. The core of application risk, as validated Semgrep rules.
Cross-site scripting (CWE-79), unsafe deserialization (CWE-502), SSRF (CWE-918), open redirect. The categories that dominate web pentest reports.
1,371 normalized regex patterns (cloud keys, tokens, hardcoded passwords, private keys) aggregated from gitleaks, noseyparker and kingfisher. Every regex compiles, deduplicated, portable.
Our own taint-mode rules (source → sink, with sanitizers) and CVE-driven, the non-clonable part of the pack. Each passes its test gate (opengrep --test) before delivery.
Python, JavaScript/TypeScript, Go, Java, C/C++, PHP, Ruby, C#, Kotlin, Rust… One rule syntax, across your entire codebase estate.
Beyond OWASP, every category is tied to compliance frameworks: OWASP ASVS 4.0, PCI-DSS 4.0, ISO/IEC 27001:2022, NIST SSDF and the EU Cyber Resilience Act. A compliance.json bundle gives you the audit-ready report, the regulatory control, not just the rule. That’s the real value resold.
Risk doesn’t stop at application code. Misconfiguration rules for Terraform (plaintext secrets, public buckets, wide-open security groups) and Dockerfile (USER root, latest tag, build-time secrets). Infrastructure-as-code audited in the same Opengrep scan, no second tool.
215 useful LGPL/GPL rules are kept apart, under their original license (redistributable with attribution, never relicensed): you choose whether to load them.
Rules aggregated from permissive Semgrep repos, deduplicated, validated on the real Opengrep engine (every rule is loaded and compiled), then normalized to CWE + OWASP-2021 (index.json + bundles by OWASP category). On top, our in-house forged rules (taint / CVE) and 1,371 secret patterns. Provenance and license retained, at the file level.
Anywhere Semgrep / Opengrep runs.
What the official semgrep-rules repo no longer lets you do.
The semgrep/semgrep-rules repo moved to a no-resale license (Semgrep Rules License v1.0, late 2024). Our feed only aggregates permissive sources (MIT/Apache/BSD), vetted at the file level: redistributable, MSSP use included.
Every rule is loaded on the real Opengrep engine (the LGPL fork of Semgrep, no dependency on the commercial ecosystem). What doesn’t compile is dropped, no broken syntax in CI.
A repo’s license badge often lies: a repo can be MIT at the root but its files carry EE/LGPL/Commons-Clause headers. We classify every rule by its header: no-resale (Commons-Clause/EE) are excluded, copyleft isolated, only permissive resold.
Every rule is normalized to a CWE and an OWASP Top-10 2021 category, with an index.json and per-category bundles. That’s the moat: you report by risk, not by rule name, ready for an audit or a compliance review.
Beyond the aggregate, our taint-mode rules (source→sink with sanitizers) and CVE-driven rules add coverage the public lists don’t have. Each passes opengrep --test before it ships.
The feed is signed; you verify its integrity before every CI integration.
The official semgrep-rules repo is free, isn’t it?
Free to use, yes, but since late 2024 the semgrep/semgrep-rules repo is under the Semgrep Rules License v1.0, which forbids resale and use in a competing product or service. An MSSP or a vendor therefore can’t redistribute it to its clients. Our feed solves that: it only aggregates permissive sources (MIT/Apache/BSD), vetted at the file level, which makes it redistributable and MSSP-usable. The content differs (other sources + our in-house rules), the angle is license compliance.
Opengrep, not Semgrep? Will my rules work?
Opengrep is the open-source (LGPL) fork of Semgrep, with the same rule syntax. We validate on Opengrep to avoid depending on any commercial component, but the rules are in standard Semgrep syntax: they run just as well with the Semgrep OSS CLI as with Opengrep. You’re not locked to any one engine.
What is the CWE / OWASP mapping for?
Every rule carries a CWE id and an OWASP Top-10 2021 category in its metadata, plus a global index.json and bundles pre-cut by OWASP category. Concretely: you filter “show me all of A03 Injection”, you produce a report by risk category rather than by rule name, and you feed a compliance review directly (PCI-DSS, ISO 27001, SSDLC). It’s that normalization work, not the raw rules, that creates the value.
How do I use it?
The pack ships a `rules/` folder (permissive, resalable), a `rules-copyleft/` (isolated LGPL/GPL), a `secrets/secrets.json` (the 1,371 patterns), an `index.json` and `bundles/` by OWASP category. Point opengrep (or semgrep) at rules/ in your CI: `opengrep scan --config rules/ .`. Pick an OWASP bundle to target a category, enable the copyleft if your project allows it. Run in report mode first, then as a blocking gate.
What licenses, and can I resell / MSSP?
The `rules/` folder only aggregates permissive content (MIT / Apache-2.0 / BSD), vetted at the file level, with attribution preserved: redistributable, MSSP use included. Commons-Clause / Enterprise Edition (no-resale) rules are excluded outright, the copyleft (LGPL/GPL) is isolated in `rules-copyleft/` under its original license, yours to load or not. The normalization, engine validation, CWE/OWASP mapping and our in-house rules are ThreatClaw’s proprietary value. Our forged rules (rules/maison/) are proprietary, (c) CyberConsulting.fr, governed by the pack EULA: use within your own security operations, not redistributable (the permissive aggregate is).
Ready to secure your code in CI?
Annual subscription. Instant key. Cancel anytime.